Esri ArcGIS server 10.1 contains a blind SQL injection vulnerability

Overview Esri's ArcGIS server version 10.1 contains a blind SQL injection vulnerability that allows remote attackers to execute a subset of SQL commands via a query operation where clause. Description The Esri ArcGIS server version 10.1 contains a blind SQL injection vulnerability CWE-89 for REST...

ESRI ArcGIS for Server - 'where' SQL Injection

source: https://www.securityfocus.com/bid/56474/info ESRI ArcGIS for Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access ...